Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

STARTTLS Everywhere

starttls-everywhere.org

Post reply on HN
Print view View original

31–40 of 106 posts

Re: STARTTLS Everywhere

#31

Post by pde3 »

mailr wrote: post #16

I'm surprised to see the opposition to self-signed certificates from the EFF. Pushing people towards centralized certificate authorities seems to be anti-freedom. Maybe there is a decentralized approach instead.

We spent a lot of time thinking about this before we started building Let's Encrypt. In the case of the Web we didn't think there was a way to make self-signed certificates workable for anything because older browsers will always error on them. In the case of mailservers, self-signed certificates work for enabling TLS, and that's great, but you're extremely vulnerable to MITM attacks. So this project offers a way to prevent the MITMs, if you want it.

If there aren't major technical obstacles we might be willing to take pull requests for STARTTLS Everywhere that allow mailservers to announce self-signing policies, but it hasn't been a priority thus far because LE certs are so easy to get and are slightly more authenticated.

Re: STARTTLS Everywhere

#32

Post by bunkydoo »

dfgdfgadsfgadfgfgjnhyju jm cnvcvccvbcxbcv dfgdf df g dfg dsf gds fg df g dfsh g hj gh h fg h fg h dfgh fg h sdfg as g sdf asd f sadf sd f sf sd f saf sad fas f as fs df s fs f h fg h jjjjhkkhjgkghkghj kgh jk gh jk ghhgfhjfgjdfggh dsfg sd g dsfgdsfdsgdsgsdgdsfgdsfgawtrthjkbncvbxzzxvzxcvzxv

z v zxc vz xcg gh k kldf5d55543554553545345545455546544654546534235443656423636435455534

435545454545553454422212546474745

Re: STARTTLS Everywhere

#33

Post by dang »

schoen wrote: post #3
djrogers wrote: post #2

Except it’s not like let’s encrypt at all. This appears to test your mail server for starttls functionality, but it doesn’t issue certs or anything like that.

I think the title of the submission is mis-editorialized. The comparison that my colleagues working on this project make is that it's like HTTPS Everywhere, or even more like the HSTS preload list, rather than like Let's Encrypt. I don't think you'll find the comparison to Let's Encrypt on the site itself. (Edit: in addition to the site tester that you noticed, there is also a public policy list and some forthcoming…

Ok, we've changed the title above to the hopefully least controversial part of the article's original title. (Submitted title was "STARTTLS Everywhere: HTTPS Everywhere, but for SMTP".)

Re: STARTTLS Everywhere

#36

Post by Boulth »

xyziemba wrote: post #22

It's worth also mentioning MTA-STS [1], currently a draft. It provides a mechanism for domains to declare a STARTTLS requirement via a file at /.well-known/mta-sts.txt" rel="nofollow">https:// /.well-known/mta-sts.txt . It's backwards compatible and opt-in. There seems to be some testing already going on [2]. [1] https://tools.ietf.org/html/draft-ietf-uta-mta-sts-21 [2] https://mta-sts.gmail.com/.well-known/mta-sts.t…

Yep, Google.com has the record too but I haven't seen them scanning my mta sts file...

Re: STARTTLS Everywhere

#37

Post by peter_tonoli »

achillean wrote: post #35

Out of ~6.5 million SMTP servers [1] on the Internet roughly 2.7 million support STARTTLS [2]. However, 1 million of them also support SSLv3 and ~200,000 still allow SSLv2. [1] https://www.shodan.io/search?query=port%3A25 [2] https://www.shodan.io/report/PIHm43GP

And how many just use self-signed certificates?

Re: STARTTLS Everywhere

#38

Post by achillean »

peter_tonoli wrote: post #37
achillean wrote: post #35

Out of ~6.5 million SMTP servers [1] on the Internet roughly 2.7 million support STARTTLS [2]. However, 1 million of them also support SSLv3 and ~200,000 still allow SSLv2. [1] https://www.shodan.io/search?query=port%3A25 [2] https://www.shodan.io/report/PIHm43GP

And how many just use self-signed certificates?

I would assume that most of the certs w/ a chain length of 1 are self-signed so around 1.6 million (out of the 2.7 million).

Re: STARTTLS Everywhere

#39

Post by jedberg »

I find it odd that the tester gets mad if it can't connect to the naked domain, even when the naked domain has MX records.

Other than that this is really cool!

It made me sad though -- I checked all the domains that I used to run mail for at some point in my career, and not one of them passed all the tests. When I managed email, I always made sure that our servers met all the current standards.

Re: STARTTLS Everywhere

#40

Post by kroeckx »

I'm still using a self-signed certificate because I'm using DANE / DNSSEC. I don't know of any tool that can properly help me automate the rollover of a let's encrypt certificate.
Post reply on HN